Monitoring connectivity and latency of a virtual network

ABSTRACT

Techniques are described herein that are capable of monitoring connectivity and latency of network links in virtual networks. For instance, a ping agent injects first ping packets into network traffic on behalf of hosts in the virtual network. The ping agent monitors incoming packets to identify first ping response packets, which are in response to the first ping packets, among the incoming packets. A ping responder rule that is included in inbound packet filter rules for a port in a virtual switch intercepts second ping packets in the network traffic. The ping responder rule converts the second ping packets into second ping response packets and injects the second ping response packets into outbound packet filter rules to be transferred to sources from which the second ping packets are received.

CROSS-REFERENCE TO RELATED APPLICATION(S)

This application claims the benefit of U.S. Provisional Application No.62/676,914, filed May 25, 2018 and entitled “Vnet Pingmesh: ContinuousMonitoring of Connectivity and Latency in Virtual Networks,” theentirety of which is incorporated by reference herein.

BACKGROUND

A virtual network is a computer network in which one or more hosts areisolated from communicating with one or more other hosts on a common(e.g., same) physical network. Each host in the virtual network may be avirtual host or a physical host. Isolation between the hosts in thevirtual network may be achieved using packet filtering, encapsulation,or other mechanisms. Many virtual networks can co-exist on the samephysical network. Within a single virtual network, hosts may be limitedin communication by network policies that restrict communication tospecific ports or protocols. Virtual networks also may be peered,allowing communication across virtual networks.

Each user or group of users of a virtual network may utilize its owncustomer addresses (CAs) for the hosts in the virtual network. Becauseusers may choose the same or overlapping address spaces, the customeraddresses (CAs) therein are not necessarily unique. Because uniqueaddresses are required to route packets through the physical network,the virtual network maps the CAs to unique platform addresses (PAs),which are used for routing in the physical network. Mapping may beperformed using a variety of techniques. For example, the CAs inoutgoing packets may be re-written to PAs on the source, and then thePAs may be re-written back to the associated CAs on the destination. Inanother example, each original packet with source and destination CAsmay be encapsulated inside an outer packet with source and destinationPAs. The outer packet may be removed (a.k.a. decapped) before the packetis delivered to the destination host. The encapsulated packet maycontain a virtual network identifier that can be used as an additionalfilter condition so that packets within one virtual network cannot bedelivered to hosts in another virtual network.

However, conventional virtual networks often require relatively complexconfiguration and packet processing, as compared to physical networks.Such complexity may result in the virtual networks having moreconnectivity and/or latency issues. These issues may be exacerbated if avirtual network is misconfigured.

SUMMARY

Various approaches are described herein for, among other things,monitoring (e.g., actively monitoring) connectivity and latency of avirtual network. For instance, to provide monitoring (e.g., continuousmonitoring) of the control plane for a virtual network, a ping agent(e.g., virtual network agent) can inject (e.g., continuously inject)ping packets between hosts in the virtual network. Examples of a hostinclude but are not limited to virtual machine, a container, a function,and a physical machine (e.g., a non-virtual server. In one example, theping agent may be a network management agent. For instance, the networkmanagement agent may program the virtual layers associated with thevirtual network. In another example, the ping agent may be separate from(e.g., a different process from) the network management agent. The pingagent may record the success or failure of each ping, as well as theround-trip-time latency. The ping agent may report the data to amonitoring system for alerting of individual link health, aggregatevirtual network health, and/or aggregate cluster health. This mayprovide near real-time monitoring of connectivity and latency of theconnections between hosts in the virtual network. The monitoring datacan be used to detect failures of the virtual network during softwaredeployments (e.g., in order to initiate rapid rollback) and/or tocontinuously monitor the health of the virtual network in a cloudenvironment and allow pro-active investigation before customers of thevirtual network detect or report issues.

In an example approach, a ping agent injects first ping packets intonetwork traffic on behalf of hosts in the virtual network. The pingagent monitors incoming packets to identify first ping response packets,which are in response to the first ping packets, among the incomingpackets. A ping responder rule that is included in inbound packet filterrules for a port in a virtual switch intercepts second ping packets inthe network traffic. The ping responder rule converts the second pingpackets into second ping response packets and injects the second pingresponse packets into outbound packet filter rules to be transferred tosources from which the second ping packets are received.

This Summary is provided to introduce a selection of concepts in asimplified form that are further described below in the DetailedDescription. This Summary is not intended to identify key features oressential features of the claimed subject matter, nor is it intended tobe used to limit the scope of the claimed subject matter. Moreover, itis noted that the invention is not limited to the specific embodimentsdescribed in the Detailed Description and/or other sections of thisdocument. Such embodiments are presented herein for illustrativepurposes only. Additional embodiments will be apparent to personsskilled in the relevant art(s) based on the teachings contained herein.

BRIEF DESCRIPTION OF THE DRAWINGS/FIGURES

The accompanying drawings, which are incorporated herein and form partof the specification, illustrate embodiments of the present inventionand, together with the description, further serve to explain theprinciples involved and to enable a person skilled in the relevantart(s) to make and use the disclosed technologies.

FIGS. 1 and 2 are block diagrams of example virtual networking pingsystems in accordance with embodiments.

FIG. 3 shows an example ping packet TCP SYN header in accordance with anembodiment.

FIG. 4 shows an example ping response packet TCP SYN-ACK header inaccordance with an embodiment.

FIGS. 5-7 depict flowcharts of example methods for monitoringconnectivity and latency of a virtual network in accordance withembodiments.

FIG. 8 depicts an example computer in which embodiments may beimplemented.

The features and advantages of the disclosed technologies will becomemore apparent from the detailed description set forth below when takenin conjunction with the drawings, in which like reference charactersidentify corresponding elements throughout. In the drawings, likereference numbers generally indicate identical, functionally similar,and/or structurally similar elements. The drawing in which an elementfirst appears is indicated by the leftmost digit(s) in the correspondingreference number.

DETAILED DESCRIPTION I. Introduction

The following detailed description refers to the accompanying drawingsthat illustrate exemplary embodiments of the present invention. However,the scope of the present invention is not limited to these embodiments,but is instead defined by the appended claims. Thus, embodiments beyondthose shown in the accompanying drawings, such as modified versions ofthe illustrated embodiments, may nevertheless be encompassed by thepresent invention.

References in the specification to “one embodiment,” “an embodiment,”“an example embodiment,” or the like, indicate that the embodimentdescribed may include a particular feature, structure, orcharacteristic, but every embodiment may not necessarily include theparticular feature, structure, or characteristic. Moreover, such phrasesare not necessarily referring to the same embodiment. Furthermore, whena particular feature, structure, or characteristic is described inconnection with an embodiment, it is submitted that it is within theknowledge of one skilled in the relevant art(s) to implement suchfeature, structure, or characteristic in connection with otherembodiments whether or not explicitly described.

II. Example Embodiments

Example embodiments described herein are capable of monitoring (e.g.,actively monitoring) connectivity and latency of a virtual network. Forinstance, to provide monitoring (e.g., continuous monitoring) of thecontrol plane for a virtual network, a ping agent (e.g., virtual networkagent) can inject (e.g., continuously inject) ping packets between hostsin the virtual network. Examples of a host include but are not limitedto virtual machine, a container, a function, and a physical machine(e.g., a non-virtual server. In one example, the ping agent may be anetwork management agent. For instance, the network management agent mayprogram the virtual layers associated with the virtual network. Inanother example, the ping agent may be separate from (e.g., a differentprocess from) the network management agent. The ping agent may recordthe success or failure of each ping, as well as the round-trip-timelatency. The ping agent may report the data to a monitoring system foralerting of individual link health, aggregate virtual network health,and/or aggregate cluster health. This may provide near real-timemonitoring of connectivity and latency of the connections between hostsin the virtual network. The monitoring data can be used to detectfailures of the virtual network during software deployments (e.g., inorder to initiate rapid rollback) and/or to continuously monitor thehealth of the virtual network in a cloud environment and allowpro-active investigation before customers of the virtual network detector report issues.

Example techniques described herein have a variety of benefits ascompared to conventional techniques for providing a virtual network. Forinstance, the example techniques may reduce latency and/or increaseconnectivity of a virtual network. High latency often precedes networkconnectivity failures and packet drops. Accordingly, monitoring latencymay facilitate discovery and mitigation of imminent connectivityfailures. As virtual networks evolve, new packet filtering and transformrules may be added. If a new rule causes an unexpected increase inlatency, the example techniques may detect this latency. The exampletechniques may use a designated (e.g., special) packet filtering rule(e.g., ping responder rules) to intercept ping packets at thedestination, before reaching virtual machine (VM) network interfaces.The example techniques may automatically inject ping response packets inresponse to the ping packets. Intercepting the ping packets and/orautomatically injecting the ping response packets may enable criticalnetworking layers (virtual network and physical network) to be monitoredwithout requiring a customer to install and run a ping agent or anyother special software or configuration on the user's VMs or even forVMs to be running. The example techniques may use designated (e.g.,special) TCP SYN and TCP SYN-ACK packets with a bit pattern in the TCPOptions header to identify virtual network ping packets and filter andreturn them within the virtual network switch. For example, TCP option250 may be used. In another example, the bit pattern may be a unique bitpattern (e.g., a signature, such as a magic number) that uniquelyidentifies the virtual network ping packets. The bit pattern may includeany suitable number of bits (e.g., 64 or 128). It may be desirable for abit pattern to be selected that is unlikely to occur in normal(non-ping) TCP SYN packets in the virtual network.

The example techniques may use a ping agent to continuously inject pingpackets, collect ping responses, and continuously report networking pingdata in near real-time (e.g., 1 minute latency) to a monitoring andalerting system. The monitoring and alerting system may aggregate pingdata at the link, VM, node, rack, cluster, and/or region level. Themonitoring and alerting system may generate alerts if networkconnectivity drops or latency spikes. These alerts can trigger manualoperator intervention or automatic mitigation procedures. The exampletechniques may monitor connectivity and latency of the virtual networkand connectivity and latency of the underlying physical network (e.g.,caused by saturated or failing physical links or switching devices).

The example techniques may be used as an internal monitoring system fora cloud computing program (e.g., Azure Networking with NMAgent). Thecloud computing program may provide infrastructure as a service (IaaS),platform as a service (PaaS), and/or software as a service (SaaS)services to the users. Examples of a cloud computing program include butare not limited to Google Cloud® developed and distributed by GoogleInc., Oracle Cloud® developed and distributed by Oracle Corporation,Amazon Web Services® developed and distributed by Amazon.com, Inc.,Salesforce® developed and distributed by Salesforce.com, Inc.,AppSource® developed and distributed by Microsoft Corporation, Azure®developed and distributed by Microsoft Corporation, GoDaddy® developedand distributed by GoDaddy.com LLC, and Rackspace® developed anddistributed by Rackspace US, Inc. It will be recognized that the exampletechniques described herein may be implemented using a cloud computingprogram. For instance, a software product (e.g., a subscription service,a non-subscription service, or a combination thereof) may include thecloud computing program, and the software product may be configured toperform the example techniques, though the scope of the exampleembodiments is not limited in this respect.

The example techniques may improve performance of a computing systemthat monitors a virtual network. For instance, the example techniquesmay reduce an amount of time and/or resources (e.g., memory, processorcycles, network bandwidth) that is consumed to monitor a virtualnetwork. The example techniques may increase efficiency of a computingsystem that is used to monitor a virtual network. The example techniquesmay increase user efficiency (e.g., efficiency of an administrator whooversees a computer network). For example, by intercepting the pingpackets and/or automatically injecting the ping response packets asdescribed herein, the example techniques may reduce a number of stepsthat are performed by an administrator, an amount of effort that theadministrator expends, and/or an amount of time that the administratortakes to oversee the computer system.

FIG. 1 is a block diagram of an example virtual networking ping system100 in accordance with an embodiment. Generally speaking, virtualnetworking system 100 operates to provide information to users (e.g.,software engineers, application developers, etc.) in response torequests (e.g., hypertext transfer protocol (HTTP) requests) that arereceived from the users. The information may include documents (e.g.,Web pages, images, audio files, video files, etc.), output ofexecutables, and/or any other suitable type of information. Inaccordance with example embodiments described herein, virtual networkingsystem 100 monitors connectivity and latency between hosts in a virtualnetwork. Virtual networking system 100 may be capable of detectingfailures in the underlying physical network, though the exampleembodiments are not limited in this respect. In some aspects, theability to detect failures in the underlying physical network may beequally important to detecting network failures in the virtual networklayers.

As shown in FIG. 1, virtual networking system 100 includes a pluralityof user systems 102A-102M, a network 104, and a plurality of servers106A-106N. Communication among user systems 102A-102M and servers106A-106N is carried out over network 104 using well-known networkcommunication protocols. Network 104 may be a wide-area network (e.g.,the Internet), a local area network (LAN), another type of network, or acombination thereof.

User systems 102A-102M are processing systems that are capable ofcommunicating with servers 106A-106N. An example of a processing systemis a system that includes at least one processor that is capable ofmanipulating data in accordance with a set of instructions. Forinstance, a processing system may be a computer, a personal digitalassistant, etc. User systems 102A-102M are configured to providerequests to servers 106A-106N for requesting information stored on (orotherwise accessible via) servers 106A-106N. For instance, a user mayinitiate a request for executing a computer program (e.g., anapplication) using a client (e.g., a Web browser, Web crawler, or othertype of client) deployed on a user system 102 that is owned by orotherwise accessible to the user. In accordance with some exampleembodiments, user systems 102A-102M are capable of accessing domains(e.g., Web sites) hosted by servers 104A-104N, so that user systems102A-102M may access information that is available via the domains. Suchdomain may include Web pages, which may be provided as hypertext markuplanguage (HTML) documents and objects (e.g., files) that are linkedtherein, for example.

Each of user devices 102A-102M may include any client-enabled system ordevice, including but not limited to a desktop computer, a laptopcomputer, a tablet computer, a wearable computer such as a smart watchor a head-mounted computer, a personal digital assistant, a cellulartelephone, an Internet of things (IoT) device, or the like. It will berecognized that any one or more user systems 102A-102M may communicatewith any one or more servers 106A-106N.

Servers 106A-106N are processing systems that are capable ofcommunicating with user systems 102A-102M. Servers 106A-106N areconfigured to execute computer programs that provide information tousers in response to receiving requests from the users. For example, theinformation may include documents (e.g., Web pages, images, audio files,video files, etc.), output of executables, or any other suitable type ofinformation. In accordance with some example embodiments, servers106A-106N are configured to host respective Web sites, so that the Websites are accessible to users of virtual networking ping system 100.

First server(s) 106A is shown to include connectivity and latency logic108 for illustrative purposes. Connectivity and latency logic 108 isconfigured to monitor connectivity and latency of one or more virtualnetworks. Connectivity and latency logic 108 includes ping agent(s) 110and ping responder rule(s) 112. Each of the ping agent(s) 108 injectsoutgoing ping packets into network traffic on behalf of host(s) in avirtual network. Each of the ping agent(s) 110 also monitors incomingpackets to identify incoming ping response packets therein. The incomingping response packets are received in response to the outgoing pingpackets. Ping agent(s) 110 run externally to hosts in the virtualnetwork. Each of the responder rule(s) 112 is included in inbound packetfilter rules for a port in a virtual switch. Each of the responderrule(s) 112 intercepts incoming ping packets, which were injected by oneor more of the ping agent(s) 110, in the network traffic. Each of theresponder rule(s) 112 converts the respective incoming ping packets intorespective outgoing ping response packets and injects the respectiveoutgoing ping response packets into outbound packet filter rules to betransferred toward the hosts from which the respective incoming pingpackets are received. It should be noted that ping packets received froma ping agent acting on behalf of a host are said to be received from thehost.

It may be said that ping agent(s) 110 and ping responder rule(s) 112collaborate to monitor the various links between the hosts in thevirtual network. To monitor the status of a link between two hosts(e.g., a “source host” and a “destination host”) in the virtual network,a ping agent associated with the source host (e.g., source virtualmachine) may inject a ping packet with a source address of the sourcehost and a destination address of the destination host (e.g.,destination virtual machine) into a port of a virtual switch that isassociated with the source host. When the ping packet arrives at thedestination host, assuming it is not lost in transit due to amisconfiguration or a failure of the virtual network or the physicalnetwork across which the virtual network overlays, a ping responder ruleon a port of a virtual switch that is associated with the destinationhost intercepts the ping packet before the ping packet can be deliveredto the destination host. Because the source ping agent runs externallyto the source host and the ping packet is intercepted before enteringthe destination host, the source and destination hosts need notnecessarily be listening for ping packets or even running in order forconnectivity and latency in the virtual network to be monitored inaccordance with the techniques described herein. Accordingly, links inthe virtual network may be monitored without being affected by the stateof the source or destination hosts. The ping responder rule thatintercepts the ping packet may swap the source and destination addressesof the ping packet to generate a ping response packet, which is thensent to the source host. Accordingly, it may be said that the pingresponder rule causes the ping packet to “bounce” off the destinationhost's virtual NIC.

Connectivity and latency logic 108 may be implemented in various ways tomonitor connectivity and latency of a virtual network, including beingimplemented in hardware, software, firmware, or any combination thereof.For example, at least a portion of connectivity and latency logic 108may be implemented as computer program code configured to be executed inone or more processors. In another example, at least a portion ofconnectivity and latency logic 108 may be implemented as hardwarelogic/electrical circuitry. For instance, at least a portion ofconnectivity and latency logic 108 may be implemented in afield-programmable gate array (FPGA), an application-specific integratedcircuit (ASIC), an application-specific standard product (ASSP), asystem-on-a-chip system (SoC), a complex programmable logic device(CPLD), etc. Each SoC may include an integrated circuit chip thatincludes one or more of a processor (e.g., a microcontroller,microprocessor, digital signal processor (DSP), etc.), memory, one ormore communication interfaces, and/or further circuits and/or embeddedfirmware to perform its functions.

Connectivity and latency logic 108 is shown to be incorporated in firstserver(s) 106A for illustrative purposes and is not intended to belimiting. It will be recognized that connectivity and latency logic 108(or any portion(s) thereof) may be incorporated in any one or more ofthe user systems 102A-102M. For example, client-side aspects ofconnectivity and latency logic 108 may be incorporated in one or more ofthe user systems 102A-102M, and server-side aspects of connectivity andlatency logic 108 may be incorporated in first server(s) 106A. Inanother example, connectivity and latency logic 108 may be distributedamong the user systems 102A-102M. In another example, connectivity andlatency logic 108 may be distributed among the server(s) 106A-106N. Instill another example, connectivity and latency logic 108 may beincorporated in a single one of the server(s) 106A-106N.

FIG. 2 is a block diagram of another example virtual networking pingsystem 200 in accordance with an embodiment. As shown in FIG. 2, virtualnetworking ping system 200 includes a first physical host 206A, a secondphysical host 206B, a monitoring and alerting system 238, and a physicalnetwork 246. For purposes of illustration, first physical host 206A isshown in FIG. 2 to provide ping packets to second physical host 206B viaphysical network 246, and second physical host 206B is shown to provideping response packets to first physical host 206A via physical network246 in response to receipt of the respective ping packets from firstphysical host 206A. In practice, the ping packets and the ping responsepackets are actually transferred between hosts that are hosted on thefirst and second physical hosts 206A and 206B via a virtual network thatoverlays across physical network 246. The flow of the ping packets isdepicted using arrows with solid heads, and the flow of the pingresponse packets is depicted using arrows with large open heads, asindicated in the legend of FIG. 2. Further detail regarding thegeneration and functionality of the ping packets and the ping responsepackets will be provided in the following discussion.

First physical host 206A includes a first ping agent 210A, a firstvirtual machine 214A, a first virtual network interface controller (NIC)216A, a first virtual switch 218A, a first external NIC 240A, andcontrol logic 244A. First ping agent 210A is configured to inject pingpackets on behalf of virtual network hosts (e.g., first virtual machine214A) and record both successful ping responses and timeouts tomonitoring and alerting system 238. First ping agent 210A is aware ofthe source addresses for VMs (e.g., first virtual machine 214A) on firstphysical host 206A and the destination addresses for all other VMs(e.g., second virtual machine 214B) in the virtual network. First pingagent 210A is able to identify the ports of virtual switches (e.g.,first virtual switch 218A) for VM NICs (e.g., first virtual NIC 216A).First ping agent 210A is further able to inject ping packets andintercept ping response packets on such ports. First ping agent 210A maybe able to receive updates for mappings of the virtual network (e.g.,mappings between CAs and PAs of the virtual network) and updates whenVMs are created or removed on first physical host 206A.

First virtual machine 214A is an emulation of a computer system.Accordingly, first virtual machine 214A may provide functionality of aphysical computer. First virtual NIC 216A is an emulation of a physicalNIC. A physical NIC is a computer hardware component that connects acomputer to a computer network. Accordingly, first virtual NIC 216Aconnects first virtual machine 214A to the virtual network.

First virtual switch 218A is an emulation of a physical network switch.A physical network switch is a computer networking device that connectssource and destination hosts together on a computer network by usingpacket switching to receive, process, and forward data to thedestination host. Accordingly, first virtual switch 218A connects firstvirtual machine 214A to other host(s) (e.g., second virtual machine214B) on the virtual network by using packet switching (a) to provideping packets to those host(s) and to receive ping response packets fromthose host(s) and/or (b) to receive ping packets from those host(s) andto provide ping response packets to those host(s). First virtual switch218A may be a feature of a hypervisor that is included in an operatingsystem that runs on first virtual machine 214A. The hypervisor may be anabstraction layer on top of the operating system that intercepts systemcalls (e.g., calls for disk access, networking access, and memoryaccess) from first virtual machine 214A. First virtual switch 218A maybe configured to enable multiple virtual machines to run on top of firstphysical host 206A, and the multiple virtual machines may share firstexternal NIC 240A. First virtual switch 218A may isolate calls from thevirtual machines such that the virtual machines cannot see each other'straffic.

First virtual switch 218A includes outbound rules 220A and inbound rules222A. Outbound rules 220A and inbound rules 222A are packet filter rulesthat implement network policies for first virtual machine 214A. Packetfilter rules are rules that can match packets based on satisfaction ofone or more criteria. Upon matching a packet, the packet filter rulesmay either drop the packet or apply transform(s) to the packet. For eachvirtual machine hosted in a hypervisor, the corresponding virtual NICmay be associated with a port in a virtual switch (VSwitch), and eachport may have both inbound and outbound packet filter rules (as shown inFIG. 2) that implement the network policies for the virtual network ofwhich the virtual machine is a member. The inbound and outbound packetfilter rules may provide isolation for customer virtual machines. Forphysical hosts external to a hypervisor, the packet filtering andtransforms necessary to implement virtual network policies may beperformed by a default router.

Outbound rules 220A include metering rules 224A, access control list(ACL) rules 226A, a ping spoof block rule 228A, a CA-to-PA map rule230A, a network virtualization using generic routing encapsulation(NVGRE) encapsulation rule 232A. The metering rules 224A define fees tobe billed to users of the virtual network for bandwidth utilization inthe virtual network. The ACL rules 226A define permissions associatedwith packets. For instance, the ACL rules 226A may specify which usersand/or system processes are granted access to the packets and/or whichoperations are allowed to be performed on which objects. The ping spookblock rule 228A blocks hosts from sending spoof ping packets, whichmight interfere with proper operation of first ping agent 210A. TheCA-to-PA map rule 230A defines a mapping between customer addresses(CAs) and platform addresses (PAs) for hosts in the virtual network. TheNVGRE encapsulation rule 232A defines how packets are to be encapsulatedprior to being provided to the virtual network.

Inbound rules 222A include metering rules 234A, ACL rules 236A, a pingresponder rule 212A, and a NVGRE encapsulation rule 242A. The meteringrule 234A, the ACL rule 236A, and the NVGRE encapsulation rule 242A areoperable in a manner similar to the metering rule 224A, the ACL rule226A, and the NVGRE encapsulation rule 232A in outbound rules 220,except that the NVGRE encapsulation rule 242A defines how packets are tobe decapsulated upon receipt from the virtual network. The pingresponder rule 212A is able to intercept ping response packets from thevirtual network. For instance, the ping responder rule 212A may preventthe ping response packets from reaching first virtual machine 214A. Theping responder rule 212A is able to convert the ping packets into pingresponse packets and to provide those ping response packets to sourcesof the ping packets from which the ping response packets are generated.It will be recognized that the ping responder rule 212A may run in thekernel of the operating system of virtual machine 214A, rather than as auser process. Accordingly, the ping responder rule 212A need notnecessarily cause a context switch within the host processor, which mayreduce processor overhead associated with monitoring the virtualnetwork.

First external NIC 240A is a physical NIC that connects first physicalhost 206A to physical network 246. Control logic 244A may be capable ofcontrolling operability of first ping agent 210A, one or more of theoutbound rules 220A, and/or one or more of the inbound rules 222A (e.g.,ping responder rule 212A). Control logic 244A may be capable of enablinga user to define a priority of subnets in the virtual network forpurposes of monitoring connectivity and latency.

Second physical host 206B includes a second ping agent 210B, a secondvirtual machine 214B, a second virtual NIC 216B, a second virtual switch218B, a second external NIC 240B, and control logic 244B, which areoperable in a manner similar to first ping agent 210A, first virtualmachine 214A, first virtual NIC 216A, first virtual switch 218A, firstexternal NIC 240A, and control logic 244A, respectively. Moreover,outbound rules 220B (including metering rules 224B, ACL rules 226B, aping spoof block rule 228B, a CA-to-PA map rule 230B, and a NVGREencapsulation rule 232B) and inbound rules 222B (including meteringrules 234B, ACL rules 236B, a ping responder rule 212B, and a NVGREencapsulation rule 242B) are operable in a manner similar to outboundrules 220A and inbound rules 222A that are included in first virtualswitch 218A.

The flow of the ping packets and the ping response packets, as depictedin FIG. 2, will now be described in further detail. First ping agent210A injects the ping packets into the outbound rules 220A. For example,first ping agent 210A may inject the ping packets through a devicedriver called a virtual filtering platform (VFP). In accordance withthis example, the device driver may plug into first virtual switch 218A.In further accordance with this example, first ping agent 210A mayprogram the device driver to create ping responder rule 212A and toinject the ping packets. In one example implementation, first ping agent210A injects the ping packets below the metering rules 224A, the ACLrules 226A, and the ping spoof block rule 228A as depicted in FIG. 2,which causes the ping packets to not be processed by any of the meteringrules 224A, the ACL rules 226A, and the ping spoof block rule 228A. Forexample, this may ensure that the ping packets are not treated asbillable traffic for a customer of the virtual network. In anotherexample, this may ensure that the ACL rules 226A do not block the pingpackets. For instance, monitoring and alerting system 238 may not becapable of distinguishing whether ping packets for which a correspondingping response packet is not received were lost due to network failure orwere blocked by the ACL rules 226A. In accordance with thisimplementation, the ping packets are processed by the CA-to-PA map rule230A and the NVGRE encapsulation rule 232A and then transferred towardthe destination host (i.e., second virtual machine 214B). In anotherexample implementation, the metering rules 224A, the ACL rules 226A, andthe ping spoof block rule 228A may be modified to ignore the pingpackets, which may enable the ping packets to be injected at the top ofthe outbound rules 220A. In accordance with this implementation, theping packets may be passed through all of the outbound rules 220A (i.e.,through the metering rules 224A, the ACL rules 226A, the ping spoofblock rule 228A, the CA-to-PA map rule 230A, and the NVGRE encapsulationrule 232A).

The ping responder rule 212B intercepts the ping packets from thevirtual network and converts the ping packets into ping responsepackets. For example, the ping responder rule 212B may set thedestination addresses associated with the respective ping responsepackets to be the same as the source addresses associated with therespective ping packets. In another example, the ping responder rule212B may swap the source and destination addresses and the source anddestination ports in each ping packet to generate the ping responsepackets. In yet another example, a source port associated with a pingpacket may have multiple addresses, and a destination port associatewith the ping packet may have multiple addresses. Any address of thesource port may be used as the source address for the ping packet, andany address of the destination port may be used as the destinationaddress for the ping packet. The first address of the source port (i.e.,the “Primary” address) may be used as the source address of the pingpacket, though the example embodiments are not limited in this respect.It will be recognized that any address associated with the source portmay be used as the source address of the ping packet. For instance, somenetworking failures or misconfigurations may be detected only if thesource address of the ping packet is selected from all addresses of thesource port and the destination address of the ping packet is selectedfrom all addresses of the destination port. The ping responder rule 212Binjects the ping response packets into the outbound rules 220B.

The ping responder rule 212B is shown to be below the metering rules234B and the ACL rules 236B for non-limiting, illustrative purposes. Itwill be recognized that the metering rules 234B and the ACL rules 236Bmay be modified to ignore the ping packets, and the ping responder rule212B may be placed at the top of the inbound rules 222B, which mayenable the ping packets to pass through all of the inbound rules 222B.

In one example implementation, the ping responder rule 212B injects theping response packets below the metering rules 224B, the ACL rules 226B,and the ping spoof block rule 228B as depicted in FIG. 2, which causesthe ping response packets to not be processed by any of the meteringrules 224B, the ACL rules 226B, and the ping spoof block rule 228B. Inaccordance with this implementation, the ping response packets areprocessed by the CA-to-PA map rule 230B and the NVGRE encapsulation rule232B and then transferred toward the newly named destination host (i.e.,first virtual machine 214A).

In another example implementation, the metering rules 224B, the ACLrules 226B, and the ping spoof block rule 228B may be modified to ignorethe ping response packets, and the ping responder rule 212B may injectthe ping response packets at the top of the outbound rules 220B. Inaccordance with this implementation, the ping response packets may passthrough all of the outbound rules 220B (i.e., through the metering rules224B, the ACL rules 226B, the ping spoof block rule 228B, the CA-to-PAmap rule 230B, and the NVGRE encapsulation rule 232B).

In an example embodiment, first ping agent 210A may inject the pingpackets with a source address of first virtual machine 214A and adestination address for one of the peers of first virtual machine 214A(e.g., second virtual machine 214B in this example) in the virtualnetwork. In accordance with this embodiment, the ping packets and theping response packets may use customer addresses for source anddestination, and therefore may validate the correct operation of thecustomer address to provider address mappings and transforms andencapsulation layers that have been programmed in first and secondvirtual switches 218A and 218B by respective first and second pingagents 210A and 210B as the ping packets and the ping response packetstraverse the network.

The ping responder rule 212A intercepts the ping response packets fromthe virtual network and forwards the ping response packets to first pingagent 210A for processing. The ping responder rule 212A is shown to bebelow the metering rules 234A and the ACL rules 236A for non-limiting,illustrative purposes. It will be recognized that the metering rules234A and the ACL rules 236A may be modified to ignore the ping responsepackets, and the ping responder rule 212A may be placed at the top ofthe inbound rules 222A, which may enable the ping response packets topass through all of the inbound rules 222A. First ping agent 210A maydetermine round-trip times associated with the ping packets and thecorresponding ping response packets. First ping agent 210A may alsodetermine whether a corresponding ping response packet was not receivedfor any of the ping packets. First ping agent 210A may forwardinformation regarding the round-trip times and any missing ping responsepackets to monitoring and alerting system 238 for processing.

Monitoring and alerting system 238 is configured to analyze theinformation received from ping agents (e.g., first ping agent 210A) todetermine whether a loss of connectivity and/or a spike in networklatency has occurred. If monitoring and alerting system 238 detects aloss of connectivity and/or a spike in network latency, monitoring andalerting system 238 generates an alert for manual operator interventionor automatic mitigation. Examples of automatic mitigation include butare not limited to (a) stopping ongoing software deployments orconfiguration changes on affected clusters or nodes, includingtriggering automatic rollback of changes, especially if deploymentscorrelate closely in time or locality (node set) with the networkfailures; (b) automatic migration of customer VMs to clusters or nodeswith healthy networking; (c) automatic throttling of low prioritynetwork traffic; and (d) automatic activation of standby networkingdevices.

Monitoring and alerting system 238 may perform aggregation of ping databased on the information that is received from first ping agent 210A todetermine a blast radius of the networking failure. A blast radiusindicates a proportion of the virtual network and/or the physicalnetwork that is impacted by the network failure. For instance, the pingdata may be aggregated to determine that the scope of the networkfailure is a single link, all links for a VM (inbound-only,outbound-only, or both), all VMs on a physical node, multiple nodes in acluster, all physical nodes in a rack (likely top-of-rack (TOR) switch),all racks in a cluster, all clusters in a region, or multiple regions.

If all the impacted nodes are under a single TOR switch, or if multipleracks under a single core switch are affected, monitoring and alertingsystem 238 may identify the likely culprit device and inform operatorsof the same, and/or monitoring and alerting system 238 may startautomatic mitigation.

In one example implementation, information regarding pings (e.g., pingpackets and ping response packets) is aggregated for a one-minuteinterval and logged. The information may indicate any of a variety ofattributes associated with each ping packet and/or each ping responsepacket. Examples of such information include but are not limited tosource and destination addresses for the packet, a VM identifierindicating a VM associated with the packet, a node identifier indicatinga physical host with which the packet is associated, a clusteridentifier indicating a cluster with which the packet is associated, asuccessful ping count (i.e., a number of ping response packetssuccessfully received), a total ping count (i.e., a total number of pingpackets sent), and latency (e.g., in microseconds).

Monitoring and alerting system 238 may provide graphs of historical pingdata and allow logs to be queried to determine connectivity and latencyfor specific VMs, nodes, and/or clusters. This historical data can beuseful to correlate in time with other logs to determine whether aconfiguration or software update or other change caused a network impacteven if the impact was not sufficient to trigger alerts (e.g., even ifthe impact does not constitute a network failure).

First ping agent 210A may be able to inject ping packets only when firstping agent 210A has correct and complete customer addresses (CAs) forthe hosts in the virtual network. If CAs are missing, then it may not bepossible for ping packets to be injected. To detect this error,monitoring and alerting system 238 may monitor the total number of pingpackets injected for a given cluster or region or other aggregation. Ifthe number of ping packets with respect to a designated duration of timedrops significantly for a cluster, monitoring and alerting system 238may generate an alert because the lower number of ping packets mayindicate an error in the CA mapping control plane for the cluster orregion.

Physical network 246 may be a wide-area network (e.g., the Internet), alocal area network (LAN), another type of network, or a combinationthereof

The ping packets have been described as flowing from first ping agent210A to the ping responder rule 212B, and the ping response packets havebeen described as flowing from the ping responder rule 212B to the pingresponder rule 212A and ultimately to first ping agent 210A, fornon-limiting illustrative purposes. It will be recognized that secondping agent 210B also provides ping packets, which are intercepted andconverted by the ping responder rule 212A; and the ping responder rule212A provides the corresponding ping response packets, which areintercepted by the ping responder rule 212B and which are forwarded tosecond ping agent 210B. The flow of the ping packets from second pingagent 210B and the flow of the corresponding ping response packets fromthe ping responder rule 212A are not shown in FIG. 2 for purposes ofclarity.

The ping packets and the ping response packets described herein may haveany suitable format. For instance, standard ICMP echo request/echoresponse packets may be used, though it should be noted that ICMPpackets often are filtered at network boundaries or layers (e.g., atload balancers) where TCP or UDP packets are allowed. ICMP packets alsolack source and destination ports and may be processed by networkinglayers differently from typical customer data flows that use TCP or UDP.Using TCP SYN for the ping packets and SYN-ACK for the ping responsepackets has the advantage that ping packets and ping response packetsare easily distinguishable in packet captures. TCP packets also have avariable length Options header that can be used to tag ping packets withidentifiable metadata. The payload of a UDP packet could also be usedfor this purpose, but the TCP Options header is more likely to alreadybe supported by packet filter parsers and less likely to occur incustomer packet flows. Accordingly, it may be desirable for a pingpacket to be formatted as a TCP SYN packet, and it may be desirable fora ping response packet to be formatted as a TCP SYN-ACK packet. A TCPSYN packet is a packet that has a SYN flag set in the TCP header. A TCPSYN-ACK packet is a packet that has a SYN flag set and an ACK flag setin the TCP header.

Because first and ping agents 210A and 210B and first and second pingresponder rules 212A and 212B actively inject significant traffic intothe virtual network, it may be desirable to implement some safetyfeatures.

A first example safety feature is a master off switch. In the exampleembodiments described herein, ping agents inject traffic into a virtualnetwork, ideally covering all links between all VMs in the virtualnetwork. It may be desirable for the ping agents to inject the pingpackets as frequently as possible to reduce the time to detect failures.This may introduce a threat, especially with large virtual networks withmany virtual machines, of an accidental ping flood in which case theping packets saturate the virtual network and interfere with normaltraffic. Incorporating ping responder rules in the packet filteringrules of the virtual switches to intercept the ping packets may cause arisk of accidentally intercepting and dropping or misdirecting customerpackets. To mitigate these risks, a master off switch configurationsetting may be implemented to remove the ping packet responder and blockrules in the virtual network filtering layers and/or disable the pinginjection threads in all the ping agents.

A second example safety feature is a rate limiter. To reduce the chanceof an accidental ping flood due to misconfiguration of ping threads,misconfiguration of the interval between pings, or duplication withinthe list of ping destinations, the rate limiter may be coded into theping injection routine that limits the number of pings injected persecond regardless of the frequency of pings requested by upper layers ofthe ping agent controller.

A third example safety feature is a destination address randomizer.There may be a risk, especially with large virtual networks with manymachines, that multiple ping agents may simultaneously ping the samevirtual machine destination address, flooding the destination virtualswitch and destination virtual machine's VNIC port. This may potentiallyoverwhelm packet buffers and cause customer traffic to be dropped. Tomitigate this risk, each ping agent may randomize the list ofdestination addresses before injecting its ping packets.

A fourth example safety feature is customer flow priority. When a TCPping packet format is used, there may be a risk that a customer mayattempt to make a connection with the same five-tuple (i.e., sourceaddress, destination address, source port, destination port, andprotocol) being injected by the ping agent as ping TCP SYN. The packetinjection routines may be configured to not allow a ping packet tointerrupt an existing customer flow with the same five-tuple and mayallow a customer flow to be created even if a ping flow with the samefive-tuple exists (i.e., the ping should return an error). The chancesof a customer flow collision may be substantially reduced if each pingpacket uses a random source port and a random destination port.

A fifth example safety feature is a RST packet. RST is the reset flag inthe Transmission Control Protocol (TCP). When a TCP ping packet formatis used, there may be a risk that networking layers on the physicalhosts or intervening network switches may allocate resources to trackthe flows (five-tuple) associated with the TCP SYN ping packet andexhaust these resources. To mitigate this risk, in addition to SYN andSYN-ACK, the ping agent may also send a TCP RST packet to thedestination to signal the various networking layers to release resourcesthat may have been allocated for the flow.

A sixth example safety feature is a ping spoof block rule. This packetfiltering rule blocks hosts from sending spoof ping packets which mightinterfere with the proper operation of the Ping Agent.

For large virtual networks containing hundreds or thousands of virtualmachines, pinging all links in a short time interval may be impossibledue to the amount of network traffic that would be generated by pingagents. To deal with this situation and allow links that are mostimportant to customers to be pinged in a short time interval,scalability features may be supported.

A first example scalability feature is active flow monitoring. The pingagent periodically queries the virtual switch to determine activecustomer flows (five-tuples) for a given virtual NIC port and may pingthose destination addresses using random or non-conflicting source anddestination ports to prevent flow collisions with the customerconnections.

A second example scalability feature is customer subnet prioritization.For each virtual network, customers can specify a list of subnetpriorities for monitoring. The list may be an ordered list of subnetpairs and/or individual subnets from higher to lower priority. For asubnet pair, the ping agent may prioritize inter-subnet pings betweenthe two subnets. For an individual subnet, the ping agent may prioritizeintra-subnet pings.

A third example scalability feature is peered virtual network sampling.In virtual network sampling, the ping agent chooses one randomdestination address from each peered VNET.

FIG. 3 shows an example ping packet TCP SYN header 300 in accordancewith an embodiment. As shown in FIG. 3, the TCP SYN header 300 includesa source address (CA1) 302, a destination address (CA2) 304, a sourceport (P1) 306, a destination port (P2) 308, a SYN flag 310, an ACK flag312, and an Options header 314. The ping packet TCP SYN header 300 ischaracterized by the SYN flag 310 being set, as depicted in FIG. 3. TheOptions header 314 includes an un-reserved TCP Option Kind, OptionLength, and an 8-byte number (e.g., “magic” number) to uniquely identifyping packets and to facilitate distinguishing the ping packets fromother traffic in the virtual network.

FIG. 4 shows an example ping response packet TCP SYN-ACK header 400 inaccordance with an embodiment. As shown in FIG. 4, the TCP SYN-ACKheader 400 includes a source address (CA2) 402, a destination address(CA1) 404, a source port (P2) 406, a destination port (P1) 408, a SYNflag 410, an ACK flag 412, and an Options header 414. The ping packetTCP SYN-ACK header 400 is characterized by the SYN flag 410 and the ACKflag 412 being set, as depicted in FIG. 4. Note that the source address(CA2) 402 in the TCP SYN-ACK header 400 is the same as the destinationaddress (CA2) 304 in the TCP SYN header 300, and the destination address(CA1) 404 in the TCP SYN-ACK header 400 is the same as the sourceaddress (CA1) 302 in the TCP SYN header. Accordingly, the source anddestination addresses in the TCP SYN header 300 have been swapped in theTCP SYN-ACK header 400, as indicated by dashed arrow 416. Note also thatthe source port (P2) 406 in the TCP SYN-ACK header 400 is the same asthe destination port (P2) 308 in the TCP SYN header 300, and thedestination port (P1) 408 in the TCP SYN-ACK header 400 is the same asthe source port (P1) 306 in the TCP SYN header 300. Accordingly, thesource and destination ports in the TCP SYN header 300 have been swappedin the TCP SYN-ACK header 400, as indicated by dashed arrow 418. TheOptions header 414 includes an un-reserved TCP Option Kind, OptionLength, and an 8-byte number (e.g., “magic” number) to uniquely identifyping response packets and to facilitate distinguishing the ping responsepackets from other traffic in the virtual network.

FIG. 5 depicts a flowchart 500 of an example method for monitoringconnectivity and latency of a virtual network in accordance with anembodiment. Flowchart 500 may be performed by virtual networking pingsystem 100 (e.g., connectivity and latency logic 108 therein) shown inFIG. 1 or virtual networking ping system 200 shown in FIG. 2, forexample. For illustrative purposes, flowchart 500 is described withrespect to virtual networking ping system 200. Further structural andoperational embodiments will be apparent to persons skilled in therelevant art(s) based on the discussion regarding flowchart 500.

As shown in FIG. 5, the method of flowchart 500 begins at step 502. Instep 502, first ping packets are injected into network traffic by a pingagent on behalf of host(s) in the virtual network. Each host in thevirtual network may be a physical host or a virtual host (e.g., avirtual machine). In one example, the ping agent executes externallyfrom the host(s) in the virtual network. In another example, the pingagent executes on a physical server that hosts a hypervisor for thehost(s) in the virtual network. In yet another example, the ping agentexecutes on a switch (e.g., a physical switch or a virtual switch) thatprovides virtual network isolation for physical hosts that participatein a virtual network and that do not run in a hypervisor. In an exampleimplementation, first ping agent 210A injects the first ping packetsinto network traffic on behalf of first virtual machine 214A in thevirtual network.

At step 504, incoming packets are monitored by the ping agent toidentify first ping response packets, which are in response to the firstping packets, among the incoming packets. In an example implementation,first ping agent 210A monitors incoming packets to identify first pingresponse packets, which are in response to the first ping packets, amongthe incoming packets.

At step 506, second ping packets are intercepted in the network trafficby a ping responder rule that is included in inbound packet filter rulesfor a port in a virtual switch. For instance, the virtual switch mayprocess network traffic for virtual machine(s) in the virtual network.In an example implementation, ping responder rule 212B, which isincluded in inbound packet implementation, ping responder rule 212B thesecond ping packets are converted into second ping filter rules 222B fora port in second virtual switch 218B, intercepts second ping packets inthe network traffic.

In an example embodiment, the inbound packet filter rules include ametering rule, an access control list (ACL) rule, and the ping responderrule. In accordance with this embodiment, intercepting the second pingpackets at step 506 includes inhibiting, by the ping responder rule, thesecond ping packets from being processed by the metering rule and theaccess control rule.

At step 508, the second ping packets are converted into second pingresponse packets and inject the second ping response packets intooutbound packet filter rules by the ping responder rule to betransferred to sources from which the second ping packets are received.In an example implementation, ping responder rule 212B converts thesecond ping packets into second ping response packets and injects thesecond ping response packets into outbound packet filter rules 220B tobe transferred to sources from which the second ping packets arereceived.

In an example embodiment, each of the second ping packets specifies asource address from which the respective second ping packet is received,a destination address to which the respective second ping packet is tobe provided, a name of a source port from which the respective secondping packet is received, and a name of a destination port to which therespective second ping packet is to be provided. In accordance with thisembodiment, converting the second ping packets into the second pingresponse packets at step 508 includes swapping the source address andthe destination address and swapping the name of the source port and thename of the destination port from each second ping packet to generatethe respective second ping response packet. In an aspect of thisembodiment, converting the second ping packets into the second pingresponse packets at step 508 may include adding a response packet flagto each second ping response packet. For example, the response packetflag may be useable to distinguish the second ping response packets fromother packets. In accordance with this example, the response packageflag may uniquely identify the second ping response packets from theother packets.

In another example embodiment, the outbound packet filter rules includea metering rule and an access control list (ACL) rule. In one aspect ofthis embodiment, injecting the first ping packets into the networktraffic at step 502 includes injecting the first ping packets into thenetwork traffic by the ping agent without passing the first ping packetsthrough the metering rule and without passing the first ping packetsthrough the access control list rule. In another aspect of thisembodiment, injecting the second ping response packets into the outboundpacket filter rules at step 508 includes injecting the second pingresponse packets into the outbound packet filter rules by the pingresponder rule without passing the second ping response packets throughthe metering rule and without passing the second ping response packetsthrough the access control list rule. In yet another example aspect ofthis embodiment, the metering rule and the access control list rule areconfigured to ignore the first ping packets and the second ping responsepackets.

In yet another example embodiment, the outbound packet filter rulesinclude a ping spoof block rule. In accordance with this embodiment, theping spoof block rule is configured to ignore the first ping packets andthe second ping response packets.

In still another example embodiment, each second ping packet isconfigured to be identifiable as a ping packet based at least in part onthe respective second ping packet having a TCP SYN header. In accordancewith this embodiment, each second ping response packet is configured tobe identifiable as a ping response packet based at least in part on therespective ping response packet having a TCP SYN-ACK header.

In some example embodiments, one or more steps 502, 504, 506, and/or 508of flowchart 500 may not be performed. Moreover, steps in addition to orin lieu of steps 502, 504, 506, and/or 508 may be performed. Forinstance, in an example embodiment, flowchart 500 further includesproviding, by the ping agent, a TCP RST packet to destination host(s)associated with the first ping packets, the TCP RST packet indicatingthat resources allocated to the first ping packets are to be released.For example, first ping agent 210A may provide the TCP RST packet tosecond virtual machine 214B.

In another example embodiment, the method of flowchart 500 furtherincludes randomizing, by the ping agent, destination addresses to whichthe first ping packets are directed before the ping agent injects thefirst ping packets into the network traffic. For instance, first pingagent 210A may randomize the destination addresses.

In yet another example embodiment, a first ping packet and an otherpacket in the network traffic share a common source address, a commondestination address, a common source port, a common destination port,and a common protocol. In accordance with this embodiment, the method offlowchart 500 further includes (a) disallowing, by the ping agent, thefirst ping packet from interrupting the other packet and/or (b)enabling, by the ping agent, the other packet to be created despite thedesignated first ping packet and the other packet sharing the commonsource address, the common destination address, the common source port,the common destination port, and the common protocol. For example, firstping agent 210A may disallow the first ping packet from interrupting theother packet and/or enable the other packet to be created.

In still another example embodiment, the method of flowchart 500 furtherincludes periodically querying the virtual switch by the ping agent todetermine destination addresses for packets that are provided via avirtual NIC port. In accordance with this embodiment, the method offlowchart 500 further includes providing ping packets to the destinationaddresses using random source and destination ports by the ping agent toavoid collisions between the ping packets and other network traffic. Forinstance, first ping agent 210A may periodically query first virtualswitch 218A to determine the destination addresses and provide the pingpackets to the destination addresses using the random source anddestination ports.

In another example embodiment, the method of flowchart 500 furtherincludes selecting, by the ping agent, one random destination address towhich a first ping packet is to be sent for each peered virtual network.For example, first ping agent 210A may select one random destinationaddress for each peered virtual network.

In yet another example embodiment, the method of flowchart 500 furtherincludes distinguishing the second ping packets from other packets inthe network traffic by the ping responder rule based at least in part oneach second ping packet having a pre-defined TCP option code and apre-defined number in an options header of the respective second pingpacket. In an aspect of this embodiment, the TCP option code mayuniquely identify the second ping packets. In another aspect of thisembodiment, the pre-defined number may be a 32-bit number, a 64-bitnumber, or a 128-bit number. In an example implementation, first pingresponder rule 212A may distinguish the second ping packets from theother packets.

In still another example embodiment, the method of flowchart 500 furtherincludes modifying the outbound packet filter rules to cause the firstping packets to not be processed by user-defined routes (UDRs). Forinstance, control logic 244A may modify outbound packet filter rules220A to cause the first ping packets to not be processed by the UDRs.

In another example embodiment, the method of flowchart 500 furtherincludes limiting a rate at which the ping agent injects the first pingpackets into the network traffic regardless of a rate at which the pingagent requests the first ping packets. For example, control logic 244Amay limit the rate at which first ping agent 210A injects the first pingpackets into the network traffic.

In yet another example embodiment, the method of flowchart 500 furtherincludes disabling the ping agent and the ping responder rule withoutinterfering with other network traffic in the virtual network based atleast in part on selection of a switch that controls operability of theping agent and the ping responder rule. For instance, control logic 244Amay disable first ping agent 210A and ping responder rule 212A withoutinterfering with the other network traffic in the virtual network.

In still another example embodiment, the method of flowchart 500 furtherincludes enabling a user of the virtual network to prioritize subnets ofthe virtual network for which to monitor connectivity and latency. Forexample, control logic 244A may enable the user to prioritize thesubnets of the virtual network.

In another example embodiment, the method of flowchart 500 includes oneor more steps of flowchart 600 in FIG. 6. As shown in FIG. 6, the methodof flowchart 600 begins at step 602. In step 602, a round-trip timeassociated with each first ping packet for which the ping agent receivesthe corresponding first ping response packet is determined by the pingagent. The round-trip time is equal to a difference between a send timeinstance at which the ping agent injects the respective first pingpacket into the network traffic and a receipt time instance at which theping agent receives the corresponding first ping response packet. In anexample implementation, first ping agent 210A determines the round-triptime associated with each first ping packet for which first ping agent210A receives the corresponding first ping response packet.

At step 604, an alert is generated (e.g., by a monitoring and alertingsystem) based at least in part on round-trip time(s) associated withrespective first ping packet(s) for which the ping agent receives thecorresponding first ping response packet(s) being greater than or equalto a threshold time. The alert may indicate (e.g., identify) thefollowing information for each first ping packet: source and destinationaddresses, IDs for physical source and destination hosts, and/or IDs forclusters that include the physical source and destination hosts. Thealert may be generated at step 604 further based at least in part on anumber of the round-trip time(s) being greater than or equal to athreshold number. In an example implementation, monitoring and alertingsystem 238 generates the alert.

At step 606, information regarding first host(s) to which the first pingpackets are directed and second host(s) to which the corresponding firstping response packets are directed is aggregated (e.g., by themonitoring and alerting system). In an example embodiment, monitoringand alerting system 238 aggregates information regarding second virtualmachine 214B to which the first ping packets are directed and firstvirtual machine 214A to which the corresponding first ping responsepackets are directed.

In an example embodiment, the aggregated information indicates a scopeof a failure of the virtual network. For instance, the aggregatedinformation may indicate that the scope of the failure is a single link;all links for a virtual machine (inbound only, outbound only, or both);all virtual machines on a physical node; multiple nodes in a cluster;all physical nodes in a rack (e.g., top-of-rack (TOR) switch); all racksin a cluster; all clusters in a region; or multiple regions. The scopeof the failure may be referred to as a “blast radius” of the failure.

At step 608, at least one response operation is automatically performed(e.g., by the monitoring and alerting system) based at least in part onthe aggregated information and further based at least in part on theround-trip time(s) associated with the respective first ping packet(s)for which the ping agent receives the corresponding first ping responsepacket(s) being greater than or equal to a threshold time. In an exampleimplantation, monitoring and alerting system 238 automatically performsat least one response operation. One example of a response operation isstopping software development and/or a configuration change oncluster(s) of nodes and/or node(s) in a cluster, based at least in parton the first host(s) and the second host(s) being included in thecluster(s) and/or the node(s). Another example of a response operationis migrating hosts associated with the first ping packet(s) tocluster(s) or node(s) that include none of the first host(s) and none ofthe second host(s). Yet another example of a response operation isthrottling network traffic having a priority that is less than athreshold priority. Still another example of a response operation isactivating standby networking devices.

In yet another example embodiment, the method of flowchart 500 includesone or more steps of flowchart 700 in FIG. 7. As shown in FIG. 7, themethod of flowchart 700 begins at step 702. In step 702, a ping timeouterror is indicated by the ping agent for each first ping packet forwhich the ping agent does not receive the corresponding first pingresponse packet. In an example implementation, first ping agent 210Aindicates the ping timeout error for each first ping packet for whichfirst ping agent 210A does not receive the corresponding first pingresponse packet.

At step 704, an alert is generated (e.g., by the monitoring and alertingsystem) based at least in part on a number of ping timeout errors beinggreater than or equal to an error threshold. In an exampleimplementation, monitoring and alerting system 238 generates the alert.

At step 706, information regarding source host(s) and destinationhost(s) is aggregated (e.g., by the monitoring and alerting system) forthe first ping packets for which the ping agent does not receive thecorresponding first ping response packets. In an example implementation,monitoring and alerting system 238 aggregates the information.

At step 708, at least one response operation is automatically performed(e.g., by the monitoring and alerting system) based at least in part onthe aggregated information and further based at least in part on anumber of ping timeout errors being greater than or equal to an errorthreshold. In an example implementation, monitoring and alerting system238 automatically performs at least one response operation. One exampleof a response operation is stopping software development and/or aconfiguration change on cluster(s) of nodes and/or node(s) in a cluster,based at least in part on the source host(s) and the destination host(s)being included in the cluster(s) and/or the node(s). Another example ofa response operation is migrating the source host(s) and the destinationhost(s) to cluster(s) or node(s) having fewer ping timeout errors thancluster(s) or node(s) from which the source host(s) and the destinationhost(s) are migrated. Yet another example of a response operation isthrottling network traffic having a priority that is less than athreshold priority. Still another example of a response operation isactivating standby networking devices.

In an example embodiment, the aggregated information indicates a scopeof a failure of the virtual network.

Any one or more of connectivity and latency logic 108, flowchart 500,flowchart 600, and/or flowchart 700 may be implemented in hardware,software, firmware, or any combination thereof. For example, any one ormore of connectivity and latency logic 108, flowchart 500, flowchart600, and/or flowchart 700 may be implemented, at least in part, ascomputer program code configured to be executed in one or moreprocessors. In another example, any one or more of connectivity andlatency logic 108, flowchart 500, flowchart 600, and/or flowchart 700may be implemented, at least in part, as hardware logic/electricalcircuitry. Such hardware logic/electrical circuitry may include one ormore hardware logic components. Examples of a hardware logic componentinclude but are not limited to a field-programmable gate array (FPGA),an application-specific integrated circuit (ASIC), anapplication-specific standard product (ASSP), a system-on-a-chip system(SoC), a complex programmable logic device (CPLD), etc. For instance, aSoC may include an integrated circuit chip that includes one or more ofa processor (e.g., a microcontroller, microprocessor, digital signalprocessor (DSP), etc.), memory, one or more communication interfaces,and/or further circuits and/or embedded firmware to perform itsfunctions.

III. Further Discussion of Some Example Embodiments

An example system to monitor connectivity and latency of a virtualnetwork comprises memory and one or more processors coupled to thememory. The one or more processors are configured to execute a pingagent and further configured to execute a ping responder rule amonginbound packet filter rules for a port in a virtual switch. The pingagent is configured to inject first ping packets into network traffic onbehalf of one or more hosts in the virtual network. The ping agent isfurther configured to monitor incoming packets to identify first pingresponse packets, which are in response to the first ping packets, amongthe incoming packets. The ping responder rule is configured to interceptsecond ping packets in the network traffic. The ping responder rule isfurther configured to convert the second ping packets into second pingresponse packets and to inject the second ping response packets intooutbound packet filter rules to be transferred to sources from which thesecond ping packets are received.

In a first aspect of the example system, the one or more processors areconfigured to execute the ping agent externally from the one or morehosts in the virtual network.

In a first example of the first aspect, the one or more processors areconfigured to execute the ping agent on a physical server that hosts ahypervisor for the one or more hosts in the virtual network.

In a second example of the first aspect, the one or more processors areconfigured to execute the ping agent on a switch that provides virtualnetwork isolation for physical hosts that participate in a virtualnetwork and that do not run in a hypervisor.

In a second aspect of the example system, each of the second pingpackets specifies a source address from which the respective second pingpacket is received, a destination address to which the respective secondping packet is to be provided, a name of a source port from which therespective second ping packet is received, and a name of a destinationport to which the respective second ping packet is to be provided. Inaccordance with the second aspect, the ping responder rule is configuredto convert the second ping packets into the second ping response packetsby swapping the source address and the destination address and byswapping the name of the source port and the name of the destinationport from each second ping packet to generate the respective second pingresponse packet. The second aspect of the example system may beimplemented in combination with the first aspect of the example system,though the example embodiments are not limited in this respect.

In an example of the second aspect, the ping responder rule isconfigured to convert the second ping packets into the second pingresponse packets further by adding a response packet flag to each secondping response packet.

In a third aspect of the example system, the ping responder rule isconfigured to distinguish the second ping packets from other packets inthe network traffic based at least in part on each second ping packethaving a pre-defined TCP option code and a pre-defined number in anoptions header of the respective second ping packet. The third aspect ofthe example system may be implemented in combination with the firstand/or second aspect of the example system, though the exampleembodiments are not limited in this respect.

In a fourth aspect of the example system, the ping agent is configuredto determine a round-trip time associated with each first ping packetfor which the ping agent receives the corresponding first ping responsepacket, the round-trip time being equal to a difference between a sendtime instance at which the ping agent injects the respective first pingpacket into the network traffic and a receipt time instance at which theping agent receives the corresponding first ping response packet. Thefourth aspect of the example system may be implemented in combinationwith the first, second, and/or third aspect of the example system,though the example embodiments are not limited in this respect.

In a first example of the fourth aspect, the one or more processors arefurther configured to execute a monitoring and alerting system, themonitoring and alerting system configured to generate an alert based atleast in part on one or more round-trip times associated with one ormore respective first ping packets for which the ping agent receives thecorresponding one or more first ping response packets being greater thanor equal to a threshold time.

In a second example of the fourth aspect, the one or more processors arefurther configured to execute a monitoring and alerting system. Themonitoring and alerting system is configured to aggregate informationregarding one or more first hosts to which the first ping packets aredirected and one or more second hosts to which the corresponding firstping response packets are directed. The monitoring and alerting systemis configured to automatically perform at least one of the followingoperations based at least in part on the aggregated information andfurther based at least in part on one or more round-trip timesassociated with one or more respective first ping packets for which theping agent receives the corresponding one or more first ping responsepackets being greater than or equal to a threshold time: stop at leastone of software development or a configuration change on at least one of(a) one or more clusters of nodes or (b) one or more nodes in a cluster,based at least in part on the one or more first hosts and the one ormore second hosts being included in the at least one of the one or moreclusters or the one or more nodes; migrate hosts associated with the oneor more first ping packets to one or more clusters or one or more nodesthat include none of the one or more first hosts and none of the one ormore second hosts; throttle network traffic having a priority that isless than a threshold priority; activate standby networking devices.

In an implementation of the second example of the fourth aspect, theaggregated information indicates a scope of a failure of the virtualnetwork.

In a fifth aspect of the example system, the ping agent is furtherconfigured to indicate a ping timeout error for each first ping packetfor which the ping agent does not receive the corresponding first pingresponse packet. In accordance with the fifth aspect, the one or moreprocessors are further configured to execute a monitoring and alertingsystem. In further accordance with the fifth aspect, the monitoring andalerting system is configured to generate an alert based at least inpart on a number of ping timeout errors being greater than or equal toan error threshold. The fifth aspect of the example system may beimplemented in combination with the first, second, third, and/or fourthaspect of the example system, though the example embodiments are notlimited in this respect.

In a sixth aspect of the example system, the ping agent is furtherconfigured to indicate a ping timeout error for each first ping packetfor which the ping agent does not receive the corresponding first pingresponse packet. In accordance with the sixth aspect, the one or moreprocessors are further configured to execute a monitoring and alertingsystem. In further accordance with the sixth aspect, the monitoring andalerting system is configured to aggregate information regarding one ormore source hosts and one or more destination hosts for the first pingpackets for which the ping agent does not receive the correspondingfirst ping response packets. In further accordance with the sixthaspect, the monitoring and alerting system is configured toautomatically perform at least one of the following operations based atleast in part on the aggregated information and further based at leastin part on a number of ping timeout errors being greater than or equalto an error threshold: stop at least one of software development or aconfiguration change on at least one of (a) one or more clusters ofnodes or (b) one or more nodes in a cluster, based at least in part onthe one or more source hosts and the one or more destination hosts beingincluded in the at least one of the one or more clusters or the one ormore nodes; migrate the one or more source hosts and the one or moredestination hosts to one or more clusters or one or more nodes havingfewer ping timeout errors than one or more clusters or one or more nodesfrom which the one or more source hosts and the one or more destinationhosts are migrated; throttle network traffic having a priority that isless than a threshold priority; activate standby networking devices. Thesixth aspect of the example system may be implemented in combinationwith the first, second, third, fourth, and/or fifth aspect of theexample system, though the example embodiments are not limited in thisrespect.

In an example of the sixth aspect, the aggregated information indicatesa scope of a failure of the virtual network.

In a seventh aspect of the example system, the inbound packet filterrules include a metering rule, an access control list (ACL) rule, andthe ping responder rule. In accordance with the seventh aspect, the pingresponder rule is configured to inhibit the second ping packets frombeing processed by the metering rule and the access control rule byintercepting the second ping packets. The seventh aspect of the examplesystem may be implemented in combination with the first, second, third,fourth, fifth, and/or sixth aspect of the example system, though theexample embodiments are not limited in this respect.

In an eighth aspect of the example system, the outbound packet filterrules include a metering rule and an access control list (ACL) rule. Inaccordance with the eighth aspect, the ping agent is configured toinject the first ping packets into the network traffic without passingthe first ping packets through the metering rule and without passing thefirst ping packets through the access control list rule. The eighthaspect of the example system may be implemented in combination with thefirst, second, third, fourth, fifth, sixth, and/or seventh aspect of theexample system, though the example embodiments are not limited in thisrespect.

In a ninth aspect of the example system, the outbound packet filterrules include a metering rule and an access control list (ACL) rule. Inaccordance with the ninth aspect, the ping responder rule is configuredto inject the second ping response packets into the outbound packetfilter rules without passing the second ping response packets throughthe metering rule and without passing the second ping response packetsthrough the access control list rule. The ninth aspect of the examplesystem may be implemented in combination with the first, second, third,fourth, fifth, sixth, seventh, and/or eighth aspect of the examplesystem, though the example embodiments are not limited in this respect.

In a tenth aspect of the example system, the outbound packet filterrules include a metering rule and an access control list (ACL) rule. Inaccordance with the tenth aspect, the metering rule and the accesscontrol list rule are configured to ignore the first ping packets andthe second ping response packets. The tenth aspect of the example systemmay be implemented in combination with the first, second, third, fourth,fifth, sixth, seventh, eighth, and/or ninth aspect of the examplesystem, though the example embodiments are not limited in this respect.

In an eleventh aspect of the example system, the outbound packet filterrules include a ping spoof block rule. In accordance with the eleventhaspect, the ping spoof block rule is configured to ignore the first pingpackets and the second ping response packets. The eleventh aspect of theexample system may be implemented in combination with the first, second,third, fourth, fifth, sixth, seventh, eighth, ninth, and/or tenth aspectof the example system, though the example embodiments are not limited inthis respect.

In a twelfth aspect of the example system, each second ping packet isconfigured to be identifiable as a ping packet based at least in part onthe respective second ping packet having a TCP SYN header. In accordancewith the twelfth aspect, each second ping response packet is configuredto be identifiable as a ping response packet based at least in part onthe respective ping response packet having a TCP SYN-ACK header. Thetwelfth aspect of the example system may be implemented in combinationwith the first, second, third, fourth, fifth, sixth, seventh, eighth,ninth, tenth, and/or eleventh aspect of the example system, though theexample embodiments are not limited in this respect.

In a thirteenth aspect of the example system, the ping agent isconfigured to provide a TCP RST packet to one or more destination hostsassociated with the first ping packets, the TCP RST packet indicatingthat resources allocated to the first ping packets are to be released.The thirteenth aspect of the example system may be implemented incombination with the first, second, third, fourth, fifth, sixth,seventh, eighth, ninth, tenth, eleventh, and/or twelfth aspect of theexample system, though the example embodiments are not limited in thisrespect.

In a fourteenth aspect of the example system, the one or more processorsare configured to disable the ping agent and the ping responder rulewithout interfering with other network traffic in the virtual networkbased at least in part on selection of a switch that controlsoperability of the ping agent and the ping responder rule. Thefourteenth aspect of the example system may be implemented incombination with the first, second, third, fourth, fifth, sixth,seventh, eighth, ninth, tenth, eleventh, twelfth, and/or thirteenthaspect of the example system, though the example embodiments are notlimited in this respect.

In a fifteenth aspect of the example system, the one or more processorsare configured to limit a rate at which the ping agent injects the firstping packets into the network traffic regardless of a rate at which theping agent requests the first ping packets. The fifteenth aspect of theexample system may be implemented in combination with the first, second,third, fourth, fifth, sixth, seventh, eighth, ninth, tenth, eleventh,twelfth, thirteenth, and/or fourteenth aspect of the example system,though the example embodiments are not limited in this respect.

In a sixteenth aspect of the example system, the ping agent isconfigured to randomize destination addresses to which the first pingpackets are directed before the ping agent injects the first pingpackets into the network traffic. The sixteenth aspect of the examplesystem may be implemented in combination with the first, second, third,fourth, fifth, sixth, seventh, eighth, ninth, tenth, eleventh, twelfth,thirteenth, fourteenth, and/or fifteenth aspect of the example system,though the example embodiments are not limited in this respect.

In a seventeenth aspect of the example system, a first ping packet andan other packet in the network traffic share a common source address, acommon destination address, a common source port, a common destinationport, and a common protocol. In accordance with the seventeenth aspect,the ping agent is configured to disallow the first ping packet frominterrupting the other packet. In further accordance with theseventeenth aspect, the ping agent is configured to enable the otherpacket to be created despite the designated first ping packet and theother packet sharing the common source address, the common destinationaddress, the common source port, the common destination port, and thecommon protocol. The seventeenth aspect of the example system may beimplemented in combination with the first, second, third, fourth, fifth,sixth, seventh, eighth, ninth, tenth, eleventh, twelfth, thirteenth,fourteenth, fifteenth, and/or sixteenth aspect of the example system,though the example embodiments are not limited in this respect.

In an eighteenth aspect of the example system, the ping agent isconfigured to periodically query the virtual switch to determinedestination addresses for packets that are provided via a virtual NICport, the ping agent further configured to provide ping packets to thedestination addresses using random source and destination ports to avoidcollisions between the ping packets and other network traffic. Theeighteenth aspect of the example system may be implemented incombination with the first, second, third, fourth, fifth, sixth,seventh, eighth, ninth, tenth, eleventh, twelfth, thirteenth,fourteenth, fifteenth, sixteenth, and/or seventeenth aspect of theexample system, though the example embodiments are not limited in thisrespect.

In a nineteenth aspect of the example system, the one or more processorsenable a user of the virtual network to prioritize subnets of thevirtual network for which to monitor connectivity and latency. Thenineteenth aspect of the example system may be implemented incombination with the first, second, third, fourth, fifth, sixth,seventh, eighth, ninth, tenth, eleventh, twelfth, thirteenth,fourteenth, fifteenth, sixteenth, seventeenth, and/or eighteenth aspectof the example system, though the example embodiments are not limited inthis respect.

In a twentieth aspect of the example system, the ping agent isconfigured to select one random destination address to which a firstping packet is to be sent for each peered virtual network. The twentiethaspect of the example system may be implemented in combination with thefirst, second, third, fourth, fifth, sixth, seventh, eighth, ninth,tenth, eleventh, twelfth, thirteenth, fourteenth, fifteenth, sixteenth,seventeenth, eighteenth, and/or nineteenth aspect of the example system,though the example embodiments are not limited in this respect.

In a twenty-first aspect of the example system, the one or moreprocessors are configured to modify the outbound packet filter rules tocause the first ping packets to not be processed by user-defined routes(UDRs). The twenty-first aspect of the example system may be implementedin combination with the first, second, third, fourth, fifth, sixth,seventh, eighth, ninth, tenth, eleventh, twelfth, thirteenth,fourteenth, fifteenth, sixteenth, seventeenth, eighteenth, nineteenth,and/or twentieth aspect of the example system, though the exampleembodiments are not limited in this respect.

In an example method of monitoring connectivity and latency of a virtualnetwork, first ping packets are injected into network traffic by a pingagent on behalf of one or more hosts in the virtual network. Incomingpackets are monitored by the ping agent to identify first ping responsepackets, which are in response to the first ping packets, among theincoming packets. Second ping packets are intercepted in the networktraffic by a ping responder rule that is included in inbound packetfilter rules for a port in a virtual switch. The second ping packets areconverted into second ping response packets and the second ping responsepackets are injected into outbound packet filter rules by the pingresponder rule to be transferred to sources from which the second pingpackets are received.

In a first aspect of the example method, the ping agent executesexternally from the one or more hosts in the virtual network.

In a first example of the first aspect, the ping agent executes on aphysical server that hosts a hypervisor for the one or more hosts in thevirtual network.

In a second example of the first aspect, the ping agent executes on aswitch that provides virtual network isolation for physical hosts thatparticipate in a virtual network and that do not run in a hypervisor.

In a second aspect of the example method, each of the second pingpackets specifies a source address from which the respective second pingpacket is received, a destination address to which the respective secondping packet is to be provided, a name of a source port from which therespective second ping packet is received, and a name of a destinationport to which the respective second ping packet is to be provided. Inaccordance with the second aspect, converting the second ping packetsinto the second ping response packets comprises swapping the sourceaddress and the destination address and swapping the name of the sourceport and the name of the destination port from each second ping packetto generate the respective second ping response packet. The secondaspect of the example method may be implemented in combination with thefirst aspect of the example method, though the example embodiments arenot limited in this respect.

In an example of the second aspect, converting the second ping packetsinto the second ping response packets comprises: adding a responsepacket flag to each second ping response packet.

In a third aspect of the example method, the example method furthercomprises distinguishing the second ping packets from other packets inthe network traffic by the ping responder rule based at least in part oneach second ping packet having a pre-defined TCP option code and apre-defined number in an options header of the respective second pingpacket. The third aspect of the example method may be implemented incombination with the first and/or second aspect of the example method,though the example embodiments are not limited in this respect.

In a fourth aspect of the example method, the example method furthercomprises determining, by the ping agent, a round-trip time associatedwith each first ping packet for which the ping agent receives thecorresponding first ping response packet. In accordance with the fourthaspect, the round-trip time is equal to a difference between a send timeinstance at which the ping agent injects the respective first pingpacket into the network traffic and a receipt time instance at which theping agent receives the corresponding first ping response packet. Thefourth aspect of the example method may be implemented in combinationwith the first, second, and/or third aspect of the example method,though the example embodiments are not limited in this respect.

In a first example of the fourth aspect, the example method furthercomprises generating an alert by a monitoring and alerting system basedat least in part on one or more round-trip times associated with one ormore respective first ping packets for which the ping agent receives thecorresponding one or more first ping response packets being greater thanor equal to a threshold time.

In a second example of the fourth aspect, the example method furthercomprises aggregating, by a monitoring and alerting system, informationregarding one or more first hosts to which the first ping packets aredirected and one or more second hosts to which the corresponding firstping response packets are directed. In accordance with the secondexample of the fourth aspect, the example method further comprisesautomatically performing at least one of the following operations by themonitoring and alerting system based at least in part on the aggregatedinformation and further based at least in part on one or more round-triptimes associated with one or more respective first ping packets forwhich the ping agent receives the corresponding one or more first pingresponse packets being greater than or equal to a threshold time:stopping at least one of software development or a configuration changeon at least one of (a) one or more clusters of nodes or (b) one or morenodes in a cluster, based at least in part on the one or more firsthosts and the one or more second hosts being included in the at leastone of the one or more clusters or the one or more nodes; migratinghosts associated with the one or more first ping packets to one or moreclusters or one or more nodes that include none of the first one or morehosts and none of the one or more second hosts; throttling networktraffic having a priority that is less than a threshold priority;activating standby networking devices.

In an implementation of the second example of the fourth aspect, theaggregated information indicates a scope of a failure of the virtualnetwork.

In a fifth aspect of the example method, the example method furthercomprises indicating, by the ping agent, a ping timeout error for eachfirst ping packet for which the ping agent does not receive thecorresponding first ping response packet. In accordance with the fifthaspect, the example method further comprises generating an alert by amonitoring and alerting system based at least in part on a number ofping timeout errors being greater than or equal to an error threshold.The fifth aspect of the example method may be implemented in combinationwith the first, second, third, and/or fourth aspect of the examplemethod, though the example embodiments are not limited in this respect.

In a sixth aspect of the example method, the example method furthercomprises indicating, by the ping agent, a ping timeout error for eachfirst ping packet for which the ping agent does not receive thecorresponding first ping response packet. In accordance with the sixthaspect, the example method further comprises aggregating, by amonitoring and alerting system, information regarding one or more sourcehosts and one or more destination hosts for the first ping packets forwhich the ping agent does not receive the corresponding first pingresponse packets. In further accordance with the sixth aspect, theexample method further comprises automatically performing at least oneof the following operations by the monitoring and alerting system basedat least in part on the aggregated information and further based atleast in part on a number of ping timeout errors being greater than orequal to an error threshold: stopping at least one of softwaredevelopment or a configuration change on at least one of (a) one or moreclusters of nodes or (b) one or more nodes in a cluster, based at leastin part on the one or more source hosts and the one or more destinationhosts being included in the at least one of the one or more clusters orthe one or more nodes; migrating the one or more source hosts and theone or more destination hosts to one or more clusters or one or morenodes having fewer ping timeout errors than one or more clusters or oneor more nodes from which the one or more source hosts and the one ormore destination hosts are migrated; throttling network traffic having apriority that is less than a threshold priority; activating standbynetworking devices. The sixth aspect of the example method may beimplemented in combination with the first, second, third, fourth, and/orfifth aspect of the example method, though the example embodiments arenot limited in this respect.

In an example of the sixth aspect, the aggregated information indicatesa scope of a failure of the virtual network.

In a seventh aspect of the example method, the inbound packet filterrules include a metering rule, an access control list (ACL) rule, andthe ping responder rule. In accordance with the seventh aspect,intercepting the second ping packets in the network traffic comprisesinhibiting, by the ping responder rule, the second ping packets frombeing processed by the metering rule and the access control rule. Theseventh aspect of the example method may be implemented in combinationwith the first, second, third, fourth, fifth, and/or sixth aspect of theexample method, though the example embodiments are not limited in thisrespect.

In an eighth aspect of the example method, the outbound packet filterrules include a metering rule and an access control list (ACL) rule. Inaccordance with the eighth aspect, injecting the first ping packets intothe network traffic comprises injecting the first ping packets into thenetwork traffic by the ping agent without passing the first ping packetsthrough the metering rule and without passing the first ping packetsthrough the access control list rule. The eighth aspect of the examplemethod may be implemented in combination with the first, second, third,fourth, fifth, sixth, and/or seventh aspect of the example method,though the example embodiments are not limited in this respect.

In a ninth aspect of the example method, the outbound packet filterrules include a metering rule and an access control list (ACL) rule. Inaccordance with the ninth aspect, injecting the second ping responsepackets into the outbound packet filter rules comprises injecting thesecond ping response packets into the outbound packet filter rules bythe ping responder rule without passing the second ping response packetsthrough the metering rule and without passing the second ping responsepackets through the access control list rule. The ninth aspect of theexample method may be implemented in combination with the first, second,third, fourth, fifth, sixth, seventh, and/or eighth aspect of theexample method, though the example embodiments are not limited in thisrespect.

In a tenth aspect of the example method, the outbound packet filterrules include a metering rule and an access control list (ACL) rule. Inaccordance with the tenth aspect, the metering rule and the accesscontrol list rule ignore the first ping packets and the second pingresponse packets. The tenth aspect of the example method may beimplemented in combination with the first, second, third, fourth, fifth,sixth, seventh, eighth, and/or ninth aspect of the example method,though the example embodiments are not limited in this respect.

In an eleventh aspect of the example method, the outbound packet filterrules include a ping spoof block rule. In accordance with the eleventhaspect, the ping spoof block rule ignores the first ping packets and thesecond ping response packets. The eleventh aspect of the example methodmay be implemented in combination with the first, second, third, fourth,fifth, sixth, seventh, eighth, ninth, and/or tenth aspect of the examplemethod, though the example embodiments are not limited in this respect.

In a twelfth aspect of the example method, each second ping packet isidentifiable as a ping packet based at least in part on the respectivesecond ping packet having a TCP SYN header. In accordance with thetwelfth aspect, each second ping response packet is identifiable as aping response packet based at least in part on the respective pingresponse packet having a TCP SYN-ACK header. The twelfth aspect of theexample method may be implemented in combination with the first, second,third, fourth, fifth, sixth, seventh, eighth, ninth, tenth, and/oreleventh aspect of the example method, though the example embodimentsare not limited in this respect.

In a thirteenth aspect of the example method, the example method furthercomprises providing, by the ping agent, a TCP RST packet to one or moredestination hosts associated with the first ping packets, the TCP RSTpacket indicating that resources allocated to the first ping packets areto be released. The thirteenth aspect of the example method may beimplemented in combination with the first, second, third, fourth, fifth,sixth, seventh, eighth, ninth, tenth, eleventh, and/or twelfth aspect ofthe example method, though the example embodiments are not limited inthis respect.

In a fourteenth aspect of the example method, the example method furthercomprises disabling the ping agent and the ping responder rule withoutinterfering with other network traffic in the virtual network based atleast in part on selection of a switch that controls operability of theping agent and the ping responder rule. The fourteenth aspect of theexample method may be implemented in combination with the first, second,third, fourth, fifth, sixth, seventh, eighth, ninth, tenth, eleventh,twelfth, and/or thirteenth aspect of the example method, though theexample embodiments are not limited in this respect.

In a fifteenth aspect of the example method, the example method furthercomprises limiting a rate at which the ping agent injects the first pingpackets into the network traffic regardless of a rate at which the pingagent requests the first ping packets. The fifteenth aspect of theexample method may be implemented in combination with the first, second,third, fourth, fifth, sixth, seventh, eighth, ninth, tenth, eleventh,twelfth, thirteenth, and/or fourteenth aspect of the example method,though the example embodiments are not limited in this respect.

In a sixteenth aspect of the example method, the example method furthercomprises randomizing, by the ping agent, destination addresses to whichthe first ping packets are directed before the ping agent injects thefirst ping packets into the network traffic. The sixteenth aspect of theexample method may be implemented in combination with the first, second,third, fourth, fifth, sixth, seventh, eighth, ninth, tenth, eleventh,twelfth, thirteenth, fourteenth, and/or fifteenth aspect of the examplemethod, though the example embodiments are not limited in this respect.

In a seventeenth aspect of the example method, a first ping packet andan other packet in the network traffic share a common source address, acommon destination address, a common source port, a common destinationport, and a common protocol. In accordance with the seventeenth aspect,the example method further comprises at least one of: disallowing, bythe ping agent, the first ping packet from interrupting the otherpacket; enabling, by the ping agent, the other packet to be createddespite the designated first ping packet and the other packet sharingthe common source address, the common destination address, the commonsource port, the common destination port, and the common protocol. Theseventeenth aspect of the example method may be implemented incombination with the first, second, third, fourth, fifth, sixth,seventh, eighth, ninth, tenth, eleventh, twelfth, thirteenth,fourteenth, fifteenth, and/or sixteenth aspect of the example method,though the example embodiments are not limited in this respect.

In an eighteenth aspect of the example method, the example methodfurther comprises periodically querying the virtual switch by the pingagent to determine destination addresses for packets that are providedvia a virtual NIC port. In accordance with the eighteenth aspect, theexample method further comprises providing ping packets to thedestination addresses using random source and destination ports by theping agent to avoid collisions between the ping packets and othernetwork traffic. The eighteenth aspect of the example method may beimplemented in combination with the first, second, third, fourth, fifth,sixth, seventh, eighth, ninth, tenth, eleventh, twelfth, thirteenth,fourteenth, fifteenth, sixteenth, and/or seventeenth aspect of theexample method, though the example embodiments are not limited in thisrespect.

In a nineteenth aspect of the example method, the example method furthercomprises enabling a user of the virtual network to prioritize subnetsof the virtual network for which to monitor connectivity and latency.The nineteenth aspect of the example method may be implemented incombination with the first, second, third, fourth, fifth, sixth,seventh, eighth, ninth, tenth, eleventh, twelfth, thirteenth,fourteenth, fifteenth, sixteenth, seventeenth, and/or eighteenth aspectof the example method, though the example embodiments are not limited inthis respect.

In a twentieth aspect of the example method, the example method furthercomprises selecting, by the ping agent, one random destination addressto which a first ping packet is to be sent for each peered virtualnetwork. The twentieth aspect of the example method may be implementedin combination with the first, second, third, fourth, fifth, sixth,seventh, eighth, ninth, tenth, eleventh, twelfth, thirteenth,fourteenth, fifteenth, sixteenth, seventeenth, eighteenth, and/ornineteenth aspect of the example method, though the example embodimentsare not limited in this respect.

In a twenty-first aspect of the example method, the example methodfurther comprises modifying the outbound packet filter rules to causethe first ping packets to not be processed by user-defined routes(UDRs). The twenty-first aspect of the example method may be implementedin combination with the first, second, third, fourth, fifth, sixth,seventh, eighth, ninth, tenth, eleventh, twelfth, thirteenth,fourteenth, fifteenth, sixteenth, seventeenth, eighteenth, nineteenth,and/or twentieth aspect of the example method, though the exampleembodiments are not limited in this respect.

An example computer program product comprises a computer-readablestorage medium having instructions recorded thereon for enabling aprocessor-based system to perform operations to monitor connectivity andlatency of a virtual network. The operations comprise inject first pingpackets into network traffic by a ping agent on behalf of one or morehosts in the virtual network. The operations further comprise monitorincoming packets by the ping agent to identify first ping responsepackets, which are in response to the first ping packets, among theincoming packets. The operations further comprise intercept second pingpackets in the network traffic by a ping responder rule that is includedin inbound packet filter rules for a port in a virtual switch. Theoperations further comprise convert the second ping packets into secondping response packets and injecting the second ping response packetsinto outbound packet filter rules by the ping responder rule to betransferred to sources from which the second ping packets are received.

IV. Example Computer System

FIG. 8 depicts an example computer 800 in which embodiments may beimplemented. Any one or more of user systems 102A-102M and/or any one ormore of servers 106A-106N shown in FIG. 1; and/or first physical host206A, second physical host 206B, and/or monitoring and alerting system238 shown in FIG. 2 may be implemented using computer 800, including oneor more features of computer 800 and/or alternative features. Computer800 may be a general-purpose computing device in the form of aconventional personal computer, a mobile computer, or a workstation, forexample, or computer 800 may be a special purpose computing device. Thedescription of computer 800 provided herein is provided for purposes ofillustration, and is not intended to be limiting. Embodiments may beimplemented in further types of computer systems, as would be known topersons skilled in the relevant art(s).

As shown in FIG. 8, computer 800 includes a processing unit 802, asystem memory 804, and a bus 806 that couples various system componentsincluding system memory 804 to processing unit 802. Bus 806 representsone or more of any of several types of bus structures, including amemory bus or memory controller, a peripheral bus, an acceleratedgraphics port, and a processor or local bus using any of a variety ofbus architectures. System memory 804 includes read only memory (ROM) 808and random access memory (RAM) 810. A basic input/output system 812(BIOS) is stored in ROM 808.

Computer 800 also has one or more of the following drives: a hard diskdrive 814 for reading from and writing to a hard disk, a magnetic diskdrive 816 for reading from or writing to a removable magnetic disk 818,and an optical disk drive 820 for reading from or writing to a removableoptical disk 822 such as a CD ROM, DVD ROM, or other optical media. Harddisk drive 814, magnetic disk drive 816, and optical disk drive 820 areconnected to bus 806 by a hard disk drive interface 824, a magnetic diskdrive interface 826, and an optical drive interface 828, respectively.The drives and their associated computer-readable storage media providenonvolatile storage of computer-readable instructions, data structures,program modules and other data for the computer. Although a hard disk, aremovable magnetic disk and a removable optical disk are described,other types of computer-readable storage media can be used to storedata, such as flash memory cards, digital video disks, random accessmemories (RAMs), read only memories (ROM), and the like.

A number of program modules may be stored on the hard disk, magneticdisk, optical disk, ROM, or RAM. These programs include an operatingsystem 830, one or more application programs 832, other program modules834, and program data 836. Application programs 832 or program modules834 may include, for example, computer program logic for implementingany one or more of connectivity and latency logic 108, ping agent(s)110, ping responder rule(s) 112, first ping agent 210A, first virtualmachine 214A, first virtual NIC 216A, first virtual switch 218A,outbound rules 220A, inbound rules 222A, metering rules 224A, ACL rules226A, ping spoof block rule 228A, CA-to-PA map rule 230A, NVGREencapsulation rule 232A, metering rules 234A, ACL rules 236A, pingresponder rule 212A, NVGRE encapsulation rule 242A, control logic 244A,second ping agent 210B, second virtual machine 214B, second virtual NIC216B, second virtual switch 218B, outbound rules 220B, inbound rules222B, metering rules 224B, ACL rules 226B, ping spoof block rule 228B,CA-to-PA map rule 230B, NVGRE encapsulation rule 232B, metering rules234B, ACL rules 236B, ping responder rule 212B, NVGRE encapsulation rule242B, control logic 244B, flowchart 500 (including any step of flowchart500), flowchart 600 (including any step of flowchart 600), and/orflowchart 700 (including any step of flowchart 700), as describedherein.

A user may enter commands and information into the computer 800 throughinput devices such as keyboard 838 and pointing device 840. Other inputdevices (not shown) may include a microphone, joystick, game pad,satellite dish, scanner, touch screen, camera, accelerometer, gyroscope,or the like. These and other input devices are often connected to theprocessing unit 802 through a serial port interface 842 that is coupledto bus 806, but may be connected by other interfaces, such as a parallelport, game port, or a universal serial bus (USB).

A display device 844 (e.g., a monitor) is also connected to bus 806 viaan interface, such as a video adapter 846. In addition to display device844, computer 800 may include other peripheral output devices (notshown) such as speakers and printers.

Computer 800 is connected to a network 848 (e.g., the Internet) througha network interface or adapter 850, a modem 852, or other means forestablishing communications over the network. Modem 852, which may beinternal or external, is connected to bus 806 via serial port interface842.

As used herein, the terms “computer program medium” and“computer-readable storage medium” are used to generally refer to media(e.g., non-transitory media) such as the hard disk associated with harddisk drive 814, removable magnetic disk 818, removable optical disk 822,as well as other media such as flash memory cards, digital video disks,random access memories (RAMs), read only memories (ROM), and the like.Such computer-readable storage media are distinguished from andnon-overlapping with communication media (do not include communicationmedia). Communication media embodies computer-readable instructions,data structures, program modules or other data in a modulated datasignal such as a carrier wave. The term “modulated data signal” means asignal that has one or more of its characteristics set or changed insuch a manner as to encode information in the signal. By way of example,and not limitation, communication media includes wireless media such asacoustic, RF, infrared and other wireless media, as well as wired media.Example embodiments are also directed to such communication media.

As noted above, computer programs and modules (including applicationprograms 832 and other program modules 834) may be stored on the harddisk, magnetic disk, optical disk, ROM, or RAM. Such computer programsmay also be received via network interface 850 or serial port interface842. Such computer programs, when executed or loaded by an application,enable computer 800 to implement features of embodiments discussedherein. Accordingly, such computer programs represent controllers of thecomputer 800.

Example embodiments are also directed to computer program productscomprising software (e.g., computer-readable instructions) stored on anycomputer-useable medium. Such software, when executed in one or moredata processing devices, causes data processing device(s) to operate asdescribed herein. Embodiments may employ any computer-useable orcomputer-readable medium, known now or in the future. Examples ofcomputer-readable mediums include, but are not limited to storagedevices such as RAM, hard drives, floppy disks, CD ROMs, DVD ROMs, zipdisks, tapes, magnetic storage devices, optical storage devices,MEMS-based storage devices, nanotechnology-based storage devices, andthe like.

It will be recognized that the disclosed technologies are not limited toany particular computer or type of hardware. Certain details of suitablecomputers and hardware are well known and need not be set forth indetail in this disclosure.

V. Conclusion

Although the subject matter has been described in language specific tostructural features and/or acts, it is to be understood that the subjectmatter defined in the appended claims is not necessarily limited to thespecific features or acts described above. Rather, the specific featuresand acts described above are disclosed as examples of implementing theclaims, and other equivalent features and acts are intended to be withinthe scope of the claims.

What is claimed is:
 1. A system to monitor connectivity and latency of avirtual network, the system comprising: memory; and one or moreprocessors coupled to the memory, the one or more processors configuredto execute a ping agent and further configured to execute a pingresponder rule among inbound packet filter rules for a port in a virtualswitch, the ping agent configured to inject first ping packets intonetwork traffic on behalf of one or more hosts in the virtual network,the ping agent further configured to monitor incoming packets toidentify first ping response packets, which are in response to the firstping packets, among the incoming packets, the ping responder ruleconfigured to intercept second ping packets in the network traffic, theping responder rule further configured to convert the second pingpackets into second ping response packets and to inject the second pingresponse packets into outbound packet filter rules to be transferred tosources from which the second ping packets are received.
 2. The systemof claim 1, wherein each of the second ping packets specifies a sourceaddress from which the respective second ping packet is received, adestination address to which the respective second ping packet is to beprovided, a name of a source port from which the respective second pingpacket is received, and a name of a destination port to which therespective second ping packet is to be provided; and wherein the pingresponder rule is configured to convert the second ping packets into thesecond ping response packets by swapping the source address and thedestination address and by swapping the name of the source port and thename of the destination port from each second ping packet to generatethe respective second ping response packet.
 3. The system of claim 1,wherein the ping responder rule is configured to distinguish the secondping packets from other packets in the network traffic based at least inpart on each second ping packet having a pre-defined TCP option code anda pre-defined number in an options header of the respective second pingpacket.
 4. The system of claim 1, wherein the ping agent is configuredto determine a round-trip time associated with each first ping packetfor which the ping agent receives the corresponding first ping responsepacket, the round-trip time being equal to a difference between a sendtime instance at which the ping agent injects the respective first pingpacket into the network traffic and a receipt time instance at which theping agent receives the corresponding first ping response packet.
 5. Thesystem of claim 4, wherein the one or more processors are furtherconfigured to execute a monitoring and alerting system, the monitoringand alerting system configured to generate an alert based at least inpart on one or more round-trip times associated with one or morerespective first ping packets for which the ping agent receives thecorresponding one or more first ping response packets being greater thanor equal to a threshold time.
 6. The system of claim 4, wherein the oneor more processors are further configured to execute a monitoring andalerting system, the monitoring and alerting system configured toaggregate information regarding one or more first hosts to which thefirst ping packets are directed and one or more second hosts to whichthe corresponding first ping response packets are directed, themonitoring and alerting system configured to automatically perform atleast one of the following operations based at least in part on theaggregated information and further based at least in part on one or moreround-trip times associated with one or more respective first pingpackets for which the ping agent receives the corresponding one or morefirst ping response packets being greater than or equal to a thresholdtime: stop at least one of software development or a configurationchange on at least one of (a) one or more clusters of nodes or (b) oneor more nodes in a cluster, based at least in part on the one or morefirst hosts and the one or more second hosts being included in the atleast one of the one or more clusters or the one or more nodes; migratehosts associated with the one or more first ping packets to one or moreclusters or one or more nodes that include none of the one or more firsthosts and none of the one or more second hosts; throttle network traffichaving a priority that is less than a threshold priority; activatestandby networking devices.
 7. The system of claim 1, wherein the pingagent is further configured to indicate a ping timeout error for eachfirst ping packet for which the ping agent does not receive thecorresponding first ping response packet; and wherein the one or moreprocessors are further configured to execute a monitoring and alertingsystem, the monitoring and alerting system configured to generate analert based at least in part on a number of ping timeout errors beinggreater than or equal to an error threshold.
 8. The system of claim 1,wherein the ping agent is further configured to indicate a ping timeouterror for each first ping packet for which the ping agent does notreceive the corresponding first ping response packet; and wherein theone or more processors are further configured to execute a monitoringand alerting system, the monitoring and alerting system configured toaggregate information regarding one or more source hosts and one or moredestination hosts for the first ping packets for which the ping agentdoes not receive the corresponding first ping response packets, themonitoring and alerting system configured to automatically perform atleast one of the following operations based at least in part on theaggregated information and further based at least in part on a number ofping timeout errors being greater than or equal to an error threshold:stop at least one of software development or a configuration change onat least one of (a) one or more clusters of nodes or (b) one or morenodes in a cluster, based at least in part on the one or more sourcehosts and the one or more destination hosts being included in the atleast one of the one or more clusters or the one or more nodes; migratethe one or more source hosts and the one or more destination hosts toone or more clusters or one or more nodes having fewer ping timeouterrors than one or more clusters or one or more nodes from which the oneor more source hosts and the one or more destination hosts are migrated;throttle network traffic having a priority that is less than a thresholdpriority; activate standby networking devices.
 9. The system of claim 1,wherein the inbound packet filter rules include a metering rule, anaccess control list (ACL) rule, and the ping responder rule; and whereinthe ping responder rule is configured to inhibit the second ping packetsfrom being processed by the metering rule and the access control rule byintercepting the second ping packets.
 10. The system of claim 1, whereinthe outbound packet filter rules include a metering rule and an accesscontrol list (ACL) rule; and wherein the ping agent is configured toinject the first ping packets into the network traffic without passingthe first ping packets through the metering rule and without passing thefirst ping packets through the access control list rule.
 11. The systemof claim 1, wherein the outbound packet filter rules include a meteringrule and an access control list (ACL) rule; and wherein the pingresponder rule is configured to inject the second ping response packetsinto the outbound packet filter rules without passing the second pingresponse packets through the metering rule and without passing thesecond ping response packets through the access control list rule. 12.The system of claim 1, wherein the outbound packet filter rules includea metering rule and an access control list (ACL) rule; and wherein themetering rule and the access control list rule are configured to ignorethe first ping packets and the second ping response packets.
 13. Thesystem of claim 1, wherein the one or more processors are configured todisable the ping agent and the ping responder rule without interferingwith other network traffic in the virtual network based at least in parton selection of a switch that controls operability of the ping agent andthe ping responder rule.
 14. The system of claim 1, wherein a first pingpacket and an other packet in the network traffic share a common sourceaddress, a common destination address, a common source port, a commondestination port, and a common protocol; wherein the ping agent isconfigured to disallow the first ping packet from interrupting the otherpacket; and wherein the ping agent is configured to enable the otherpacket to be created despite the designated first ping packet and theother packet sharing the common source address, the common destinationaddress, the common source port, the common destination port, and thecommon protocol.
 15. The system of claim 1, wherein the ping agent isconfigured to periodically query the virtual switch to determinedestination addresses for packets that are provided via a virtual NICport, the ping agent further configured to provide ping packets to thedestination addresses using random source and destination ports to avoidcollisions between the ping packets and other network traffic.
 16. Amethod of monitoring connectivity and latency of a virtual network, themethod comprising: injecting first ping packets into network traffic bya ping agent on behalf of one or more hosts in the virtual network;monitoring incoming packets by the ping agent to identify first pingresponse packets, which are in response to the first ping packets, amongthe incoming packets; intercepting second ping packets in the networktraffic by a ping responder rule that is included in inbound packetfilter rules for a port in a virtual switch; and converting the secondping packets into second ping response packets and injecting the secondping response packets into outbound packet filter rules by the pingresponder rule to be transferred to sources from which the second pingpackets are received.
 17. The method of claim 16, wherein each secondping packet is identifiable as a ping packet based at least in part onthe respective second ping packet having a TCP SYN header; and whereineach second ping response packet is identifiable as a ping responsepacket based at least in part on the respective ping response packethaving a TCP SYN-ACK header.
 18. The method of claim 16, furthercomprising: providing, by the ping agent, a TCP RST packet to one ormore destination hosts associated with the first ping packets, the TCPRST packet indicating that resources allocated to the first ping packetsare to be released.
 19. The method of claim 16, further comprising:limiting a rate at which the ping agent injects the first ping packetsinto the network traffic regardless of a rate at which the ping agentrequests the first ping packets.
 20. The method of claim 16, furthercomprising: randomizing, by the ping agent, destination addresses towhich the first ping packets are directed before the ping agent injectsthe first ping packets into the network traffic.
 21. The method of claim16, further comprising: enabling a user of the virtual network toprioritize subnets of the virtual network for which to monitorconnectivity and latency.
 22. The method of claim 16, furthercomprising: selecting, by the ping agent, one random destination addressto which a first ping packet is to be sent for each peered virtualnetwork.
 23. The method of claim 16, further comprising: modifying theoutbound packet filter rules to cause the first ping packets to not beprocessed by user-defined routes (UDRs).
 24. A computer program productcomprising a computer-readable storage medium having instructionsrecorded thereon for enabling a processor-based system to performoperations to monitor connectivity and latency of a virtual network, theoperations comprising; inject first ping packets into network traffic bya ping agent on behalf of one or more hosts in the virtual network;monitor incoming packets by the ping agent to identify first pingresponse packets, which are in response to the first ping packets, amongthe incoming packets; intercept second ping packets in the networktraffic by a ping responder rule that is included in inbound packetfilter rules for a port in a virtual switch; and convert the second pingpackets into second ping response packets and injecting the second pingresponse packets into outbound packet filter rules by the ping responderrule to be transferred to sources from which the second ping packets arereceived.